Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

Jeremy A. Hansen writes "NIST just announced their selections for algorithms going to the second round of the SHA-3 competition. Quoting: 'NIST received 64 SHA-3 candidate hash function submissions and accepted 51 first round candidates as meeting our minimum acceptance criteria. We have now selected 14 second round candidates to continue in the competition. Information about the second round candidate algorithms will be available here. We were pleased by the amount and quality of the cryptanalysis we received on the first round candidates, and more than a little amazed by the ingenuity of some of the attacks. ... In selecting this set of second round candidates we tried to include only algorithms that we thought had a chance of being selected as SHA-3. We were willing to extrapolate higher performance for conservative designs with apparently large safety factors, but comparatively unforgiving of aggressive designs that were broken, or nearly broken during the course of the review. We were more willing to accept disquieting properties of the hash function if the designer had apparently anticipated them, than if they were discovered during the review period, even if there were apparent fixes. We were generally alarmed by attacks on compression functions that seemed unanticipated by the submitters.'"

I was a little worried by the plethora of submissions. I was worried it would take them forever to decide. But luckily they've been rather ruthless in culling for the third round. Given the data available on the The SHA-3 Zoo [tugraz.at] they chose wisely.

Personally, I think Skein [skein-hash.info] is interestingly feature rich, which both worries and intrigues me. Looking it appears that all the features are built on a core in which the real security lies, so I'm not too worried. Skein's core in fact appears to be extremely simple.

I consider Bruce Scheier as a cryptographer to be sort of like Carl Sagan as an astronomer. I think he is a competent cryptographer, but I think he has much greater value as a person who can speak cogently about the issues surrounding cryptography.

In this case, my guess is that he led the overall vision of how Skein should work but that the other people who worked on the algorithm filled in the details. In particular, I strongly suspect that Niels Ferguson is principally responsible for the core algorithm. Of course, pulling apart any particular collaboration and looking for the efforts of individuals can be tricky and error prone at best.

Skein is getting a lot of attention because Bruce Schneier is one of it's authors. It's a fine algorithm. Personally, after going through a bunch of them, I like BLAKE [131002.net] the best since its extremely simple and relies on old and proven functions that have withstood the test of time. Not to mention that it's extremely fast. I also like Blue Midnight Wish. I think the NIST will pick one of these three.

The thing I like about Skein is its tree mode. I've been working on a parallelizing version of sha256sum to see if I can speed up the generation of hashes 4-fold with my dual-core dual-processor system.

I also like the ways you can make it unique for a given usage. This will help make it more resistant to various kinds of attacks when used in particular applications and mitigate the effect of certain kinds of algorithm weaknesses if they're discovered.

But yeah, there are other candidates, and I'm more interested in the highest possible quality algorithm coming out of the process than I am in having my particular horse win.

Pretty much every hash in the competition can work in tree mode. Not all submitters defined a tree mode, but that shouldn't stop NIST from defining a good one.

There are better performers than Skein, so unless those are all seriously weakened I doubt it can win. Skein looks good on high end hardware, and not so good on anything else (compared to some other top competitors).

I knew about Schneier being involved from early on, but I just noticed Bernstein made the last cut. Considering Bernstein's thoroughness (64-bit timestamps in his programs, and didn't he once talk about writing his own filesystem to address an external limitation that slowed down qmail?), I am very intrigued at how well CubeHash will do. He apparently admits that it suffers from some performance problems, but also says that he over-engineered it, and that it can be scaled back to improve speed while losing little in the way of security.

Of the 14 candidates going into this round, his is one of only six that hasn't had to be revised so far. Of course, that he seems to have designed it completely on his own may work against him.

Depending on what you call a revision, Bernstein just revised CubeHash. A few days ago he posted a parameter tweak that significantly increases performance at the cost of some security. You can read about his tweak on his website at: http://cubehash.cr.yp.to/submission/tweak.pdf [cr.yp.to]

In a practical sense, yes, but the generic preimage attacks against the 512-bit variant of CubeHash work better as the "b" parameter increases. It's still well above the birthday bound, so maybe people shouldn't care. But, it does mean CubeHash16/32-512 "only" provides 384 bits of preimage resistance. That's probably beyond theoretical computation limits for the universe, so I think there's a pretty good argument we shouldn't care. At the same time, all the attacks, and preimage attacks in particular, w

There have been a few AES based candidates for SHA-3. Basically they improve on Whirlpool. So the ideas of Whirlpool were taken and enhanced for the competition.

Using AES certainly has advantages. It may be possible to use current hardware acceleration and a lot is known of the algorithm. Newer hardware may combine the two. The disadvantages are also numerous.

AES was never designed with hashing in mind and may have unknown vulnerabilities. Current hardware may not be resistant against some attacks that are

One of my favourites (Blue Midnight Wish) made it through, and one of the others with a really cool name (SandSTORM) wasn't broken in the 1st round.

Yes, I know, that's NOT how to pick hash functions, but you've got to admit that cryptography isn't capturing the popular imagination at the present time, leaving data dangerously insecure. I believe that part of this is because most popular crypto-related functions (and cryptographic hashing is definitely one) have names that are a turnoff.

Once upon a time, computing was for "the Egg Heads" and anyone daring to mention computers was automatically One Of Them. The Apple made computing sexy and it became fashionable.

Cryptography has to do the same thing, if security is to be meaningful. Otherwise, it will remain for "Egg Heads Only" and we will continue to see horrific losses from naive and pathetic practices by people trying to avoid being tarred as geeky.

I suspect that, as with many other parts of computing, the people at large will use it once it becomes largely automatic, and not much before(crypto has the additional complication that it makes it even easier for n00bs to lose large amounts of data).

As for crypto marketing, "military grade" seems to be the appellation of choice. Pity it means absolutely nothing...

Encryption was considered a munition for export-control purposes (technically, I think it still is), but that didn't extend to hash functions.
It will be interesting to see what NSA does with the eventual SHA-3. NSA has cleared AES for Top Secret classified information. We'll see if they do the same thing with SHA-3. If so, then you really could call it military-grade. Though, really its tamper-resistant hardware chips that sets military-grade stuff apart from commercial stuff.

Military grade, according to ITAR, means the key is more than 56 bits (used to be 40 bits). Which, you're right, means nothing.

Now, if I use the term "military-grade" for crypto, I would mean an algorithm that is certified NIST/NESSIE-approved for Secret or above (for mundane usage) or NIST/NESSIE-approved for Top Secret (for information that is commercially sensitive). That is still arguably market-babble, but at least it has a measure of respectability because NIST and NESSIE are reasonably trustworthy or

It doesn't matter how cool the name is: once the winner is picked it will be SHA-3, in the same way that Rijndael became AES. In fact, the name Rijndael had slipped my memory and I had to Google it - and I'm interested in crypto.

Besides, the general public might be able to name WEP and WPA as "types of encryption", but to hope for more than that, no matter how cool the name, is optimistic.

Cryptography must be simple, now it's too complicated to install and configure. And most end users don't see why they should bother. I think that there should be a separated encrypted mail network where everything is encrypted by default and you can't turn encryption off. This way you can set all your relatives on this system and be sure that nothing will be sent unencrypted.
[shameless plug on]

Basically if MD6 is withdrawn it will not have too much value left for the immediate future. It will only live on in the minds of crypto-analysts for their next algorithms. It won't be adopted in any cryptographic products (both the all important libraries and hardware).

Nobody in their right mind is using both MD5 and SHA-1 together, and even if they do they are both standardized hash methods. Combining hash methods

Nobody in their right mind is using both MD5 and SHA-1 together, and even if they do they are both standardized hash methods. Combining hash methods is dangerous at least and should not be done haphazardly. It would be much better to use SHA-2 256 instead, if only because it is a standardized hash and not some weird combination of two.

I think the author doesn't mean to combine SHA-1 and MD5 to make one hash, but instead using both hashes. This may be weaker for preimage attacks, but a lot stronger against c

If he gets it standardized and included in standard implementations of cryptographic software and hardware - he would definitely have something there. But I would take opt for SHA-2 instead. It's well defined and present in more devices that having MD5 and SHA-1 work together. Of course that does not mean it cannot be included in proprietary or closed protocols, but for those anything goes. I agree that I may have put that a bit too strong though. But pretty please (with sugar on top) don't opt for these ki

I've been doing a fair bit of reading about secure hashes recently... as I'm interested in one specific property of hash functions that, as far as I can tell, is not discussed as widely as I'd expect... While collisions seem to draw a lot of attention, they are not of particular interest to me... since collisions (for me) affect only performance - not security.

The closest term for what I'm interested in is preimage resistance [wikipedia.org] - but, as far as I can tell, this property is often disregarded as it is considere

It is trivial to prove that a function is one way. If the input is from a larger domain than the output. ie a^b=c is one way. given c I cannot recover a and b. Of course this is not a good function to use for other reasons....

If however the input is the same length then its a little harder...The only way we know how to do is the way this competition is doing it. Propose a "one way" function, others then try and break it. Otherwise you need a collision which in this context is a bad thing due to reduced r

Everything you say makes sense, and I'm familiar with this technical background.

If I were to re-phrase my question, in the context of your reply, I'd be asking if equivalences have been shown between known-hard problems and the inverse to standard HMACs.

The particular issue that interests me is extremely similar to (type-1) preimage... but it is slightly easier to break. T1-preimage requires me to find m where H(m) is known. In my specific situation, we also know the length of m - it's the same as H(m) -

The ultimate SHA should have a hash space as large as the count of atoms in the universe - then you can just select the atom involved and use its assigned number. Of course, collisions between atoms might be an issue.